Services for Macintosh

Printing Authentication

Native Macintosh networking does not support authentication for printers. Users do not need to be authenticated to use the print service; therefore, it is not possible to restrict use of network printers by Macintosh clients. If a Macintosh client is physically capable of sending a print job to a print device or a print server, it has implicit permission to do so. However, it is possible, if a print server is started from a user account, to attach an Access Control List (ACL) to a specific printer so that a user has access to the spooler but not to the printer itself. In this case, the Macintosh user is not able to print to that specific printer.

In addition, it is possible for a system administrator to enforce one set of user-level print permissions for all Macintosh print clients as a group. The Macintosh client must start the MacPrint service by logging on as the System account, which has Print permission on all local print devices. To limit the permissions for Macintosh clients, create a new user account and give it the printer permissions you want the group to have. Then, set the Macintosh client MacPrint service to log on with this account.

Note

The System account on one computer does not have access permission for resources on other computers. Macintosh clients that start the MacPrint service by logging on as System user cannot send jobs to printers that forward jobs to other print servers. The solution is to configure the Macintosh client MacPrint service to log on as another user, one which has permission to print on all the print servers to which print jobs are forwarded.